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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF FLORIDA 


IRA KLEIMAN, as the personal representative 
of the Estate of David Kleiman, and W&K Info 
Defense Research, LLC, 

Plaintiffs, 
Vv. 


CRAIG WRIGHT, 


Defendant. 








CASE NO.: 9:18-cv-80176-BB 


CONTAINS CONFIDENTIAL 
INFORMATION SUBJECT TO 
PROTECTIVE ORDER 


THIRD SUPPLEMENTAL 
EXPERT REPORT OF DR. MATTHEW J. EDMAN 
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I submit this Supplemental Report in the above-captioned action on behalf of Ira Kleiman, 
as the personal representative of the Estate of David Kleiman, and W&K Info Defense Research, 


LLC (collectively, “Plaintiffs”). 


1. DEF_01813375 

LL. I reviewed DEF_01813375, which is a Microsoft Word document that purports to 
be a “LLM Dissertation Proposal” written by “Craig S Wright” titled “Payments Providers and 
Intermediaries as Defined in the Law of the Internet.” 

2 Microsoft Word documents contain metadata that indicate, among other things, the 
date the document was created and when it was last edited. (Exs. 1-4.) I reviewed the document 
metadata using Microsoft Word. (Ex. 5.) According to the document properties displayed by 
Micosoft Word, the document was purportedly created on June 18, 2007, and last modified on 
October 28, 2007. I also examined the document metadata using olefile 0.46. (Ex. 6.) The metadata 
extracted by olefile is consistent with the document properties displayed in Microsoft Word. 

3 Metadata in Microsoft Word documents also includes the version of Microsoft 
Word that was last used to modify the document, as well as the operating system on which the 
document was last modified. (Exs. 3-4.) The metadata in DEF 01813375 indicates it was last 
modified using Microsoft Word 16.0 on the Windows 10 operating system. (Exs. 6-8.) Microsoft 
Word 16.0 is the version number assigned to Microsoft Word 2016 or later (Ex. 9), which was first 
released in September 2015 (Ex. 10). Windows 10 was released in July 2015 (Ex. 11) — 
approximately eight years after the document was purportedly last modified. 

4. Based on the above findings, it is my opinion that DEF 01813375 has been 


manipulated and therefore is not an authentic document. 
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II. DEF_01108419 

5. I reviewed DEF 01108419, which is an email from “Craig S Wright” to 
“smatthews@sterling.ph” titled “FW: coin-ex.” “Ramona Watts” is CC’ ed on the email. The email 
message contains a screenshot which purports to show that a PDF document called “20140625 
Trust Instruction.pdf’ was cryptographically signed by a PGP key associated with Dave Kleiman. 
The email message attaches a file named DK.RAR. DK.RAR is a compressed file which, in turn, 
contains three files: 

a. “20140625 Trust Instruction.pdf’,! which purports to be a “Shareholders 
Agreement” for Coin-Exch dated April 2, 2013.7 

b. “20140625 Trust Instruction.pdf.gpg”,* which appears to be a PGP-encrypted 
version of “20140625 Trust Instruction.pdf”’ 

c. “20140625 Trust Instruction.pdf.sig”,* which appears to be a PGP signature of 
the file “20140625 Trust Instruction.pdf”’ 

6. I verified and analyzed the cryptographic signature in “20140625 Trust 
Instruction.pdf.sig” using GnuPG 2.2.28. (Ex. 12.) The GnuPG output indicates the file contains a 
valid signature of “20140625 Trust Instruction.pdf”’ created on April 1, 2013, at 11:12:53 PM UTC 
according to the computer on which it was created, which is equivalent to April 2, 2013, at 


10:12:53 AM UTC+11. The GPG output further indicates the cryptographic signature was created 


' This document corresponds to Defendant’s production document DEF 01108421. 

? While the content of the document itself purports to be from April 2013, I note that the date in 
the filename appears to reference June 25, 2014. 

3 This document corresponds to Defendant’s production document DEF 01108458. 

* This document corresponds to Defendant’s production document DEF 01108459. 


3 
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with the PGP key ID ADDAOEB2E545EB7B, which is the same key used to create a cryptographic 
signature of DEF_00013188 purportedly by Dave Kleiman over a year after he died. 

cz I also extracted and analyzed° the PDF metadata in “20140625 Trust 
Instruction.pdf.” (Ex. 13.) The metadata indicates the PDF was allegedly created on April 2, 2013, 
at 10:09:18 AM UTC+11 — approximately three minutes before the cryptographic signature in 
“20140625 Trust Instruction.pdf.sig” was allegedly created. 

8. I identified and extracted multiple font files embedded within the PDF file. The 
font files each contained cryptographic signatures, which I extracted using a hex editor and 
analyzed using OpenSSL 1.1.1g. (Exs. 14-16.) I determined the font files contained cryptographic 
signatures created by Microsoft in July 2013—approximately three months after the PDF and its 
cryptographic signature were allegedly created. 

2. Based on the above findings, it is my opinion that the PDF file “20140625 Trust 
Instruction.pdf’ contained in DEF 01108419 has been manipulated and therefore is not an 
authentic document. 

I. DEFAUS_01584851 

10. [reviewed DEFAUS_01584851, which is a PDF that appears to be a digital scan 
of a hardcopy document with additional handwritten marks on it. The document purports to be 
dated January 30, 2009. 

Lh. I extracted and analyzed the PDF metadata in DEFAUS 01584851. (Exs. 17-18.) 
The metadata indicates the PDF was created on March 15, 2014, at 10:02:22 AM UTC+11. The 


metadata also indicates, however, that the document and its metadata were purportedly modified 


> See Section V(B) in my December 2019 expert report and its Exhibit 16. 
° | extracted and analyzed the metadata using 010 Editor v10.0.2 and PDFStreamDumper 
v0.9.627. 
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on July 8, 2009, at 9:19:29 AM UTC+10—over four years before it was even created. The 
metadata’s “xmpmeta’” field further indicates that the metadata itself was created using a software 
version that did not exist until August 23, 2012. 

12. — Talso reviewed DEF_01908063, which is a Microsoft Word document that appears 
visually identical to the scanned hardcopy document in DEFAUS 01584851, except 
DEF 01908063 lacks the handwritten notations. I reviewed the document properties in 
DEF _01908063 in Microsoft Word. (Ex. 19.) I also extracted the XML-based metadata embedded 
within the file using 7-Zip 19.0.’ (Exs. 20-21.) The extracted metadata and the document properties 
both indicate DEF_01908063 was created on or about September 21, 2010—almost two years after 
the date shown in DEFAUS 01584851. The document properties further indicate the document 
was created by “Michael Shehadie” and last modified by “Lynn Wright.” The title of the document 
is “SHARE SALE AGREEMENT made the day of 1998” (spaces retained 
as in DEF_ 01908063). 

13. L also reviewed DEF 01652819, which is another Microsoft Word document that 
appears visually similar to DEFAUS_01584851 except (a) the agreement month and day are blank, 
(b) it lists “CRAIG STEPHEN WRIGHT” as a party instead of “CRAIG STEVEN WRIGHT,” 
and (c) the portion labeled “THE SCHEDULE” has not been completed. I reviewed the document 
properties in DEF 01652819 using Microsoft Word. (Ex. 23.) I also extracted the metadata 
embedded within the file using olefile. (Ex. 24.) The extracted metadata and the document 
properties indicate DEF _ 01652819 has the same title (“SHARE SALE AGREEMENT made the 


day of 1998”), company (“Michie Shehadie & Co’), and author (“Michael 


7 Microsoft Word .docx files are similar to compressed ZIP archive files in that their contents 
and internal structure can be viewed using most tools capable of opening compressed archive 
files. (Ex. 22). 
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Shehadie”’) as DEF 01908063 but was created and last modified on or about September 17, 
2010—approximately four days before the completed version in DEF_01908063 which is visually 
identical to DEFAUS_01584851. 

14. Based on the above findings, it is my opinion that the DEFAUS_01584851 has been 


manipulated and therefore is not an authentic document. 


Dated: September 17, 2021 


MO 


Dr. Matthew J. Edman 
New York, NY 
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APPENDIX A. DOCUMENTS REVIEWED 


Production Document Native File Hash (MD5) 

DEF_01813375 06ab50d379e2e65efdffb4a82449add9 
DEF_01108419 1acdc0261e8eac4111ce509e34b7a86d 
DEF_01108421 3ea11c9a1021F115817cf47dF893072c 
DEF_01108458 842e7a7c5cdd9e09c94530b09178da26 
DEF_01108459 dea3f2c5didea4eb188b4795a1c28498 
DEFAUS_ 01584851 db58d0eff176477bd08a3a76d66bf4a2 
DEF_01908063 db2ea281bca6db741e4b05119d22cbal1 
DEF_01652819 9a36ee772b8cdcded520d46e0807a25d 
DK.RAR 6438663d06581a476F61608aebF55086 


